Why most risk registers go stale
They are created as a compliance deliverable, owned by no one in particular, and reviewed only when an audit requires it. The fix is not a better template. It is a different ownership model.
Feature one: a named owner per AI system
Each row should map to a named person, not a team. That person reviews the entry when the system changes, when an incident occurs, or on the quarterly review date. Without a name, it belongs to everyone and therefore nobody.
Feature two: triggered reviews, not just scheduled ones
A quarterly review is a baseline. But registers should also update when a vendor changes its model, when you deploy in a new context, or when regulation changes. Write those triggers into the register itself.
Feature three: short entries, not comprehensive ones
A risk entry that takes 20 minutes to update will not get updated. Describe the risk in one sentence, the control in one sentence, the status in one line. Link to more detail if needed.
AI Act Ready builds a working risk register as part of every readiness scan, structured to stay current rather than to satisfy a one-time audit.